Send visitors to the HTTPS address

Visitors who open a page over plain http are redirected to the same page on https. Only runs on the live site (production), so local copies keep working.

Type PHP
Runs Everywhere (runs as WordPress loads)
Category Security
Tested with WordPress 7.1

Before you switch it on: Open your site at https:// first. Behind Cloudflare’s Flexible SSL or a proxy that doesn’t tell WordPress about HTTPS, this would redirect in a loop: don’t use it there.

It arrives switched off, even when you install its whole pack with "Switch on after installing".

PHP

<?php

add_action(
	'template_redirect',
	static function () {
		if ( is_ssl() || 'production' !== wp_get_environment_type() || ( defined( 'WP_CLI' ) && WP_CLI ) ) {
			return;
		}
		$host = isset( $_SERVER['HTTP_HOST'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_HOST'] ) ) : '';
		$uri  = isset( $_SERVER['REQUEST_URI'] ) ? esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : '/';
		if ( $host && wp_parse_url( home_url(), PHP_URL_HOST ) === $host ) {
			wp_safe_redirect( 'https://' . $host . $uri, 301 );
			exit;
		}
	},
	1
);

Good to know

Set your WordPress and site addresses to https:// too (Settings > General). If your host already redirects to https, you don’t need this.

In these packs

Install it in one click

It's already in the Snipfire plugin's library. Enter your site's address and it opens there, ready to install. It arrives switched off, and Snipfire checks the code and test-loads your site before you switch it on.

Needs Snipfire on that site and you logged in as an administrator. Your address stays in this browser; we don't see it. Get Snipfire free

Or add it by hand

Click + New and choose PHP.
Paste the code and give it a name.
Where: Everywhere (runs as WordPress loads).
Save and switch it on.

Works in any snippet plugin, or a child theme's functions.php. Without the safety net, though.

Good to know

In these packs

More Security snippets

Move your snippets over this afternoon.